Privacy Policy

Who operates Enkind

Enkind (https://enkind.space) is a community marketplace service. Contact is only available through the in-app contact form when email delivery is configured — there is no public email address on this site.

What we collect

When you use Enkind, we store:

• Account: name, email address, and a bcrypt hash of your password (we do not store plaintext passwords).
• Profile (optional): bio and location if you add them.
• Community and trade data: communities you create or join; listings; proposals and counters; agreements (including click-to-sign name, timestamp, and IP address recorded at signature); ratings; disputes; listing/member reports; personal-network invites and vouches.
• Session: an httpOnly cookie (enkind_session) holding a signed JWT (HS256) for up to 30 days so you stay logged in.
• Abuse prevention: IP-keyed counters in a rate_limits table for login, signup, contact, password-reset, and report attempts.
• Email tokens (when email is configured): hashed single-use links for password reset and email verification (stored in auth_tokens, expire after 30 minutes). Transactional messages may also cover trade events if you have not opted out.

Analytics

We use Vercel Web Analytics (first-party) for anonymous page views and product funnel events (signup, community_created, listing_created, proposal_sent, agreement_signed, rated). We do not load third-party advertising trackers.

How we use data

• To provide accounts, communities, and the trade loop.
• To keep you signed in and protect against abuse.
• To send transactional email (password reset, verification, trade notifications) only when an email provider is configured — these features degrade gracefully when unset.

Processors

We use Vercel to host the application and Neon to host the Postgres database. They process data on our behalf to run the service. We do not sell your personal data.

Retention and deletion

Account and trade records are kept while your account is active. You may request account deletion; we will remove or anonymize personal account fields where feasible, subject to records needed for dispute history between other parties. Use the contact form (when available) or in-product settings once deletion self-serve is offered.

Children

Enkind is not directed at children under 13, and we do not knowingly collect personal information from them.

Changes

We may update this policy as the product changes. The “Last updated” date at the top will change when we do. Material changes will be reflected here before or when they take effect.